Predictive human behavioral analysis of psychometric features on a computer network

Abstract

The invention relates to a predictive network behavioural analysis system for a computer network, IT system or infrastructure, or similar. More particularly, the present invention relates to a behavioural analysis system for users of a computer network that incorporates machine learning techniques to predict user behaviour. According to a first aspect, there is provided a method for predicting a change in behaviour by one or more users of one or more monitored computer networks for use with normalised user interaction data, comprising the steps of: identifying from metadata events corresponding to a plurality of user interactions with the monitored computer networks; testing the identified events using one or more learned probabilistic models, each of said learned probabilistic models being related to a behavioural trait and being based on identified patterns of user interactions; and calculating a score using said one or more learned probabilistic models indicating the probability of a change in a behavioural trait of the user.

1 . A method for predicting a change in behaviour by one or more users of one or more monitored computer networks for use with normalised user interaction data, comprising the steps of:
 identifying from metadata events corresponding to a plurality of user interactions with the monitored computer networks;   testing the identified events using one or more learned probabilistic models, each of said learned probabilistic models being related to a behavioural trait and being based on identified patterns of user interactions; and   calculating a score using said one or more learned probabilistic models indicating the probability of a change in a behavioural trait of the user.   
     
     
         2 . The method of  claim 1 , further comprising one or more of the following steps:
 extracting relevant parameters from the metadata and mapping said relevant parameters to a common data schema, thereby creating normalised user interaction data;   storing the normalised user interaction event data from the identified events corresponding to a plurality of user interactions with the monitored computer networks; and   storing user interaction event data derived from the identified said events corresponding to a plurality of user interactions with the monitored computer networks and updating the one or more learned probabilistic models from said stored user interaction event data.   
     
     
         3 . (canceled) 
     
     
         4 . The method of  claim 1 , wherein the identified patterns of user interactions are related to historic user activity prior to the identified events, wherein the historic user activity comprises one or more of: individual user historic activity; user peers historic activity and/or interactions with an individual user; historic user group behaviour learned from a plurality of organisations. 
     
     
         5 - 6 . (canceled) 
     
     
         7 . The method of  claim 1 , wherein the step of testing each of said plurality of user interactions with the monitored computer networks against one or more learned probabilistic models further comprises the step of identifying abnormal user interactions. 
     
     
         8 . The method of  claim 1 , wherein said user interaction event data comprises any or a combination of:
 data related to a user involved in an event;   data related to an action performed in an event;   data related to a device and/or application involved in an event; and/or   data related to the time of the event.   
     
     
         9 . The method of  claim 1 , further comprising the step of storing contextual data, wherein said contextual data is related to a user interaction event and/or any of: a user identity; an action; an object involved in said event; an organisation; an industry; or economic, political or social data that is contextually relevant. 
     
     
         10 . The method of  claim 9 , wherein the step of identifying from the metadata events corresponding to a plurality of user interactions further comprises the step of identifying additional parameters by reference to contextual data and/or wherein the one or more learned probabilistic models comprises one or more heuristics related to contextual data. 
     
     
         11 - 12 . (canceled) 
     
     
         13 . The method of  claim 9 , wherein user interaction event data and contextual data are stored in a graph database and/or wherein step of storing metadata and/or the relevant parameters therefrom are stored in a search-engine database, relational or document database. 
     
     
         14 . (canceled) 
     
     
         15 . The method of  claim 1 , wherein the one or more learned probabilistic models are implemented using a trained machine-learning model; a neural network; an artificial neural network; and/or continuous time analysis. 
     
     
         16 - 17 . (canceled) 
     
     
         18 . The method of  claim 1 , further comprising the step of testing two or more of said plurality of user interactions in combination against said one or more learned probabilistic models and optionally determining whether said two or more of the plurality of user interactions are part of an identifiable sequence of user interactions indicating user behaviour in performing an activity. 
     
     
         19 . (canceled) 
     
     
         20 . The method of  claim 18 , wherein the time difference between two or more of said plurality of user interactions is tested, preferably against the time difference of related historic user interactions, optionally wherein the related historic user interactions comprise interactions associated with at least one of: an individual user; additional users in one or more companies; additional users in one or more groups of users. 
     
     
         21 - 25 . (canceled) 
     
     
         26 . The method of  claim 1 , wherein each of the plurality of user interactions with the monitored computer networks are tested substantially immediately following said user interaction event data being identified or according to a predetermined schedule in parallel with other tests, optionally wherein testing according to a predetermined schedule comprises analysing all available user interaction data corresponding to a plurality of user interactions with the monitored computer networks, wherein said plurality of user interactions occurred within a predetermined time period. 
     
     
         27 - 28 . (canceled) 
     
     
         29 . The method of  claim 1 , further comprising one or more of the following steps:
 classifying calculated scores using one or more predetermined or dynamically calculated thresholds   receiving the metadata from within the one or more monitored computer networks and optionally aggregating metadata at a single entry point, preferably wherein metadata is received at a device via one or more of: a third party server instance; a client server within one or more computer networks; a direct link with the one or more devices; an API service; or simply manually received   reporting or alerting on predicted excluded events or changes in behavioural traits;   implementing one or more precautionary measures in response to predicted changes in behavioural traits, said precautionary measures comprising one or more of: issuing a warning, issuing a block on a user or device or a session involving said user or device, suspending one or more user accounts, suspending one or more users' access to certain resources, saving data, and/or performing a custom programmable action, optionally wherein the one or more precautionary measures are selected in dependence on the calculated score, in dependence on detected user response to one or more previously implemented precautionary measures, and/or in dependence on the excluded event;   receiving feedback related to changes in behaviour traits, optionally weighted in dependence on the type of feedback received; and   generating human-readable information relating to user interaction events and optionally presenting said information as part of a timeline.   
     
     
         30 . The method of  claim 1 , wherein the calculated scores are calculated in additional dependence on one or more correlations between tested user interactions and one or more historic user interactions involving at least one of: the user; a group of users the user is part of or labelled as part of; similar users in one or more organisations; action types; action times; and/or objects involved in the tested user interactions. 
     
     
         31 . The method of  claim 1 , wherein the plurality of user interactions with the monitored computer networks is tested against two or more learned probabilistic models, the results of the two or more probabilistic models being analysed by a further probabilistic model to calculate a further score indicating the probability of the user changing one or more higher level behavioural traits. 
     
     
         32 - 41 . (canceled) 
     
     
         42 . The method of  claim 1 , wherein the behavioural trait comprises: an excluded event; a user behavioural change; a user stress level; a user mental state; or a user mistake. 
     
     
         43 . The method of  claim 1 , wherein the computer network comprises one or more of: a mobile device; a personal computer; a server; a virtual network; an online service; or an audited online service. 
     
     
         44 . Apparatus for predicting one or more changes in behavioural traits of one or more users of one or more monitored computer networks, comprising:
 a data pipeline module configured to identify from the metadata events corresponding to a plurality of user interactions with the monitored computer networks, the data pipeline module optionally being configured to normalise the plurality of user interactions using a common data schema; and   an analysis module comprising a trained machine learning model implementing one or more probabilistic models, each of said probabilistic models being related to a behavioural trait and being based on identified patterns of user activity and/or interactions,   wherein the analysis module is used to test each of said plurality of user interactions with the monitored computer networks against one or more probabilistic models and calculate a score indicating the probability of the user performing one or more excluded events.   
     
     
         45 . Apparatus according to  claim 44 , further comprising one or more of the following:
 a metadata-ingesting module configured to receive and aggregate metadata from one or more devices within the one or more monitored computer networks;   a user interface accessible via a web portal and/or mobile application; and   a transfer module configured to aggregate and send at least a portion of the metadata from the one or more devices within the one or more monitored computer networks, wherein the transfer module is within the one or more monitored computer networks.   
     
     
         46 - 48 . (canceled) 
     
     
         49 . Apparatus or computer program product comprising software code for carrying out the method of  claim 1 . 
     
     
         50 - 92 . (canceled)